The version of MySQL running on the remote host is 5.7.x prior to 5.7.16. It is, therefore, affected by multiple vulnerabilities :

  - Multiple integer overflow conditions exist in s3_srvr.c,     ssl_sess.c, and t1_lib.c due to improper use of pointer     arithmetic for heap-buffer boundary checks. An     unauthenticated, remote attacker can exploit this to     cause a denial of service. (CVE-2016-2177)

  - An information disclosure vulnerability exists in the     dsa_sign_setup() function in dsa_ossl.c due to a failure     to properly ensure the use of constant-time operations.
    An unauthenticated, remote attacker can exploit this,     via a timing side-channel attack, to disclose DSA key     information. (CVE-2016-2178)

  - A denial of service vulnerability exists in the DTLS     implementation due to a failure to properly restrict the     lifetime of queue entries associated with unused     out-of-order messages. An unauthenticated, remote     attacker can exploit this, by maintaining multiple     crafted DTLS sessions simultaneously, to exhaust memory.
    (CVE-2016-2179)

  - An out-of-bounds read error exists in the X.509 Public     Key Infrastructure Time-Stamp Protocol (TSP)     implementation. An unauthenticated, remote attacker can     exploit this, via a crafted time-stamp file that is     mishandled by the 'openssl ts' command, to cause     denial of service or to disclose sensitive information.
    (CVE-2016-2180)

  - A denial of service vulnerability exists in the     Anti-Replay feature in the DTLS implementation due to     improper handling of epoch sequence numbers in records.
    An unauthenticated, remote attacker can exploit this,     via spoofed DTLS records, to cause legitimate packets to     be dropped. (CVE-2016-2181)

  - An overflow condition exists in the BN_bn2dec() function     in bn_print.c due to improper validation of     user-supplied input when handling BIGNUM values. An     unauthenticated, remote attacker can exploit this to     crash the process. (CVE-2016-2182)

  - A vulnerability exists, known as SWEET32, in the 3DES     and Blowfish algorithms due to the use of weak 64-bit     block ciphers by default. A man-in-the-middle attacker     who has sufficient resources can exploit this     vulnerability, via a 'birthday' attack, to detect a     collision that leaks the XOR between the fixed secret     and a known plaintext, allowing the disclosure of the     secret text, such as secure HTTPS cookies, and possibly     resulting in the hijacking of an authenticated session.
    (CVE-2016-2183)

  - An unspecified flaw exists in the Security: Encryption     subcomponent that allows an authenticated, remote     attacker to disclose sensitive information.
    (CVE-2016-5584)

  - A flaw exists in the tls_decrypt_ticket() function in     t1_lib.c due to improper handling of ticket HMAC     digests. An unauthenticated, remote attacker can exploit     this, via a ticket that is too short, to crash the     process, resulting in a denial of service.
    (CVE-2016-6302)

  - An integer overflow condition exists in the     MDC2_Update() function in mdc2dgst.c due to improper     validation of user-supplied input. An unauthenticated,     remote attacker can exploit this to cause a heap-based     buffer overflow, resulting in a denial of service     condition or possibly the execution of arbitrary code.
    (CVE-2016-6303)

  - A flaw exists in the ssl_parse_clienthello_tlsext()     function in t1_lib.c due to improper handling of overly     large OCSP Status Request extensions from clients. An     unauthenticated, remote attacker can exploit this, via     large OCSP Status Request extensions, to exhaust memory     resources, resulting in a denial of service condition.
    (CVE-2016-6304)

  - An out-of-bounds read error exists in the certificate     parser that allows an unauthenticated, remote attacker     to cause a denial of service via crafted certificate     operations. (CVE-2016-6306)

  - A flaw exists in the check_log_path() function within     file sql/sys_vars.cc due to inadequate restrictions on     the ability to write to the my.cnf configuration file     and allowing the loading of configuration files from     path locations not used by current versions. An     authenticated, remote attacker can exploit this issue     by using specially crafted queries that utilize logging     functionality to create new files or append custom     content to existing files. This allows the attacker to     gain root privileges by inserting a custom .cnf file     with a 'malloc_lib=' directive pointing to specially     crafted mysql_hookandroot_lib.so file and thereby cause     MySQL to load a malicious library the next time it is     started. (CVE-2016-6662)

  - A flaw exists in wolfSSL, specifically within the C     software version of AES Encryption and Decryption, due     to table lookups not properly considering cache-bank     access times. A local attacker can exploit this, via a     specially crafted application, to disclose AES keys.
    (CVE-2016-7440)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of OpenSSL installed on the remote AIX host is affected by the following vulnerabilities :

  - Multiple integer overflow conditions exist in s3_srvr.c,     ssl_sess.c, and t1_lib.c due to improper use of pointer     arithmetic for heap-buffer boundary checks. An     unauthenticated, remote attacker can exploit this to     cause a denial of service. (CVE-2016-2177)

  - An information disclosure vulnerability exists in the     dsa_sign_setup() function in dsa_ossl.c due to a failure     to properly ensure the use of constant-time operations.
    An unauthenticated, remote attacker can exploit this,     via a timing side-channel attack, to disclose DSA key     information. (CVE-2016-2178)

  - A denial of service vulnerability exists in the DTLS     implementation due to a failure to properly restrict the     lifetime of queue entries associated with unused     out-of-order messages. An unauthenticated, remote     attacker can exploit this, by maintaining multiple     crafted DTLS sessions simultaneously, to exhaust memory.
    (CVE-2016-2179)

  - An out-of-bounds read error exists in the X.509 Public     Key Infrastructure Time-Stamp Protocol (TSP)     implementation. An unauthenticated, remote attacker can     exploit this, via a crafted time-stamp file that is     mishandled by the 'openssl ts' command, to cause     denial of service or to disclose sensitive information.
    (CVE-2016-2180)

  - A denial of service vulnerability exists in the     Anti-Replay feature in the DTLS implementation due to     improper handling of epoch sequence numbers in records.
    An unauthenticated, remote attacker can exploit this,     via spoofed DTLS records, to cause legitimate packets to     be dropped. (CVE-2016-2181)

  - An overflow condition exists in the BN_bn2dec() function     in bn_print.c due to improper validation of     user-supplied input when handling BIGNUM values. An     unauthenticated, remote attacker can exploit this to     crash the process. (CVE-2016-2182)

  - A vulnerability exists, known as SWEET32, in the 3DES     and Blowfish algorithms due to the use of weak 64-bit     block ciphers by default. A man-in-the-middle attacker     who has sufficient resources can exploit this     vulnerability, via a 'birthday' attack, to detect a     collision that leaks the XOR between the fixed secret     and a known plaintext, allowing the disclosure of the     secret text, such as secure HTTPS cookies, and possibly     resulting in the hijacking of an authenticated session.
    (CVE-2016-2183)

  - A flaw exists in the tls_decrypt_ticket() function in     t1_lib.c due to improper handling of ticket HMAC     digests. An unauthenticated, remote attacker can exploit     this, via a ticket that is too short, to crash the     process, resulting in a denial of service.
    (CVE-2016-6302)

  - An integer overflow condition exists in the     MDC2_Update() function in mdc2dgst.c due to improper     validation of user-supplied input. An unauthenticated,     remote attacker can exploit this to cause a heap-based     buffer overflow, resulting in a denial of service     condition or possibly the execution of arbitrary code.
    (CVE-2016-6303)

  - A flaw exists in the ssl_parse_clienthello_tlsext()     function in t1_lib.c due to improper handling of overly     large OCSP Status Request extensions from clients. An     unauthenticated, remote attacker can exploit this, via     large OCSP Status Request extensions, to exhaust memory     resources, resulting in a denial of service condition.
    (CVE-2016-6304)

  - An out-of-bounds read error exists in the certificate     parser that allows an unauthenticated, remote attacker     to cause a denial of service via crafted certificate     operations. (CVE-2016-6306)

  - A flaw exists in the GOST ciphersuites due to the use of     long-term keys to establish an encrypted connection. A     man-in-the-middle attacker can exploit this, via a Key     Compromise Impersonation (KCI) attack, to impersonate     the server.

  - A denial of service vulnerability exists in x509_vfy.c     due to improper handling of certificate revocation lists     (CRLs). An unauthenticated, remote attacker can exploit     this, via a specially crafted CRL, to cause a NULL     pointer dereference, resulting in a crash of the     service. (CVE-2016-7052)

According to its banner, the version of OpenSSL on the remote host is 1.0.1 prior to 1.0.1u, or 1.0.2 prior to 1.0.2i.  It is therefore affected by the following vulnerabilities :

 - A flaw exists in 'ssl/s3_srvr.c', 'ssl/ssl_sess.c', and 'ssl/t1_lib.c' that may under certain circumstances lead to integer overflows and allow an attacker to have an unspecified impact. (CVE-2016-2177)
 - A flaw exists in 'crypto/dsa/dsa_ossl.c' that is triggered as the DSA signing algorithm does not properly run in constant time.  This may potentially allow a context-dependent attacker to conduct e.g. a side channel attack and gain unauthorized access to DSA key information. (CVE-2016-2178)
 - A flaw exists that is due to the system not handling fragmented DTLS buffered messages correctly.  There are two scenarios where messages could result in the queue not being cleared and memory not being freed.  The first occurs when a full message is received after a fragment of the same message, and the system uses the full message while ignoring the fragmented message without removing it from queue.  The second occurs when a peer sends a 'future' message with extraneous packets containing a sequence number higher than the Finished message, resulting in the packets not being removed from queue.  With a saturation of either type of message, a remote attacker can exhaust up to 1500k of memory per connection, exhausting memory leading to a remote denial of service. (CVE-2016-2179)
 - An out-of-bounds read flaw exists in the 'TS_OBJ_print_bio()' function in 'crypto/ts/ts_lib.c'.  This may allow a context-dependent attacker to have an unspecified impact that may potentially include crashing a process linked against the library or disclosing memory contents. (CVE-2016-2180)
 - A flaw exists in the DTLS implementation that is triggered when handling epoch sequence numbers in records.  This may allow a remote attacker to cause legitimate packets to be dropped. (CVE-2016-2181)
 - An overflow condition exists in the 'BN_bn2dec()' function in 'crypto/bn/bn_print.c'.  The issue is triggered as certain input is not properly validated when handling BIGNUM values. This may allow a context-dependent attacker to cause a buffer overflow, resulting in a denial of service in a process linked against the library. (CVE-2016-2182)
 - A flaw exists in the 'tls_decrypt_ticket()' function in 'ssl/t1_lib.c' that is triggered during the handling of ticket HMAC digest.  This may allow a remote attacker to crash the service. (CVE-2016-6302)
 - An overflow condition exists in the 'MDC2_Update()' function in 'crypto/mdc2/mdc2dgst.c' that is triggered as certain input is not properly validated.  This may allow a context-dependent attacker to cause a heap-based buffer overflow, crashing a process linked against the library or potentially allowing the execution of arbitrary code. (CVE-2016-6303)
 - A flaw exists in the 'ssl_parse_clienthello_tlsext()' function in 'ssl/t1_lib.c' that is triggered when handling overly large OCSP Status Request extensions from clients.  This may allow a remote attacker to exhaust available memory in a process linked against the library. (CVE-2016-6304)
 - An out-of-bounds read flaw exists that is triggered when handling client certificate, client certificate request, and server certificate messages.  This may allow a remote attacker to potentially crash a process linked against the library. (CVE-2016-6306)

ID	名稱	產品	系列	已發布	已更新	嚴重性
94198	MySQL 5.7.x < 5.7.16 Multiple Vulnerabilities (October 2016 CPU) (SWEET32)	Nessus	Databases	2016/10/21	2020/6/3	critical
95255	AIX OpenSSL Advisory : openssl_advisory21.asc (SWEET32)	Nessus	AIX Local Security Checks	2016/11/22	2023/4/21	critical
9625	OpenSSL 1.0.1 < 1.0.1u / 1.0.2 < 1.0.2i Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	2016/10/6	2019/3/6	high

偵測

搜尋 Plugin

critical

critical

high